From bda64cb7d4f04bda46a5fff36c21595af9ef0c35 Mon Sep 17 00:00:00 2001
From: d1vious <josehelps@gmail.com>
Date: Wed, 24 Nov 2021 16:26:17 -0500
Subject: [PATCH] added logic to include test file in the detections, also
 renamed the files to have prefixed ssa____ on name

---
 bin/generate.py                               | 109 ++++++++++--------
 ...olen_credentials_via_mimikatz_modules.yml} |  11 ++
 ...n_credentials_via_powersploit_modules.yml} |  11 ++
 ...tial_strength_via_dsinternals_modules.yml} |   0
 ...l => ssa___attempt_to_delete_services.yml} |  13 ++-
 ... => ssa___attempt_to_disable_services.yml} |  11 ++
 ...ential_dump_from_registry_via_reg_exe.yml} |  11 ++
 ...of_fgdump_and_cachedump_with_s_option.yml} |   0
 ...of_fgdump_and_cachedump_with_v_option.yml} |   0
 ...ative_of_lazagne_command_line_options.yml} |   0
 ...ternals_credential_conversion_modules.yml} |   0
 ...icative_of_use_of_dsinternals_modules.yml} |   0
 ...indicative_of_use_of_mimikatz_modules.yml} |   0
 ...icative_of_use_of_powersploit_modules.yml} |   0
 ...rosoft_debuggers_peek_into_the_kernel.yml} |   0
 ...t_debuggers_via_z_command_line_option.yml} |   0
 ...resent_in_powersploit_and_dsinternals.yml} |   0
 ...t_user.yml => ssa___delete_a_net_user.yml} |  11 ++
 ...__deny_permission_using_cacls_utility.yml} |  11 ++
 ...etect_dump_lsass_memory_using_comsvcs.yml} |  11 ++
 ...ing.yml => ssa___detect_kerberoasting.yml} |  11 ++
 ...ash.yml => ssa___detect_pass_the_hash.yml} |   8 +-
 ...hibited_applications_spawning_cmd_exe.yml} |  71 +++++++-----
 ...yml => ssa___disable_net_user_account.yml} |  11 ++
 ...first_time_seen_command_line_argument.yml} |   0
 ..._grant_permission_using_cacls_utility.yml} |  11 ++
 ..._user_content_via_powersploit_modules.yml} |   0
 ...ount_creation_via_powersploit_modules.yml} |  11 ++
 ...deletion_of_logs_via_mimikatz_modules.yml} |   0
 ...g_of_accounts_via_dsinternals_modules.yml} |   0
 ..._and_policies_via_dsinternals_modules.yml} |   0
 ...tory_elements_via_powersploit_modules.yml} |   0
 ...d_persistence_via_powersploit_modules.yml} |  12 ++
 ...vilege_elevation_via_mimikatz_modules.yml} |  11 ++
 ..._process_control_via_mimikatz_modules.yml} |  11 ++
 ...ocess_control_via_powersploit_modules.yml} |  11 ++
 ...y_acls_permission_of_files_or_folders.yml} |  12 ++
 ...bas_applications_in_short_time_period.yml} |   0
 ...tion_by_machine_learning_method_-_ssa.yml} |   0
 ...sh_observed_at_the_destination_device.yml} |   0
 ...bserved_by_an_event_collecting_device.yml} |   0
 ...n_credentials_via_powersploit_modules.yml} |  12 ++
 ...are_parent-child_process_relationship.yml} |   0
 ...ounts_and_groups_via_mimikatz_modules.yml} |   0
 ..._and_policies_via_powersploit_modules.yml} |   0
 ...nfrastructure_via_powersploit_modules.yml} |   0
 ...s_and_domains_via_powersploit_modules.yml} |   0
 ...ess_to_computers_via_mimikatz_modules.yml} |   0
 ...stem_elements_via_powersploit_modules.yml} |   0
 ...ses_and_services_via_mimikatz_modules.yml} |   0
 ...shared_resources_via_mimikatz_modules.yml} |   0
 ...red_resources_via_powersploit_modules.yml} |   0
 ...opportunities_via_powersploit_modules.yml} |   0
 ..._connectivity_via_powersploit_modules.yml} |   0
 ...res_and_services_via_mimikatz_modules.yml} |   0
 ...fensive_tools_via_powersploit_modules.yml} |   0
 ...opportunities_via_powersploit_modules.yml} |   0
 ...ng_opportunities_via_mimikatz_modules.yml} |   0
 ... => ssa___resize_shadowstorage_volume.yml} |  11 ++
 .../ssa___sdelete_application_execution.yml   | 105 +++++++++++++++++
 ...g_credentials_via_dsinternals_modules.yml} |  11 ++
 ...ting_credentials_via_mimikatz_modules.yml} |  11 ++
 ...g_credentials_via_powersploit_modules.yml} |  11 ++
 ...cess_running_from_unexpected_location.yml} |   0
 ... => ssa___unusually_long_command_line.yml} |  11 ++
 ...=> ssa___wevtutil_usage_to_clear_logs.yml} |  11 ++
 ... ssa___wevtutil_usage_to_disable_logs.yml} |  11 ++
 67 files changed, 491 insertions(+), 82 deletions(-)
 rename dist/ssa/detections/{applying_stolen_credentials_via_mimikatz_modules.yml => ssa___applying_stolen_credentials_via_mimikatz_modules.yml} (83%)
 rename dist/ssa/detections/{applying_stolen_credentials_via_powersploit_modules.yml => ssa___applying_stolen_credentials_via_powersploit_modules.yml} (83%)
 rename dist/ssa/detections/{assessment_of_credential_strength_via_dsinternals_modules.yml => ssa___assessment_of_credential_strength_via_dsinternals_modules.yml} (100%)
 rename dist/ssa/detections/{attempt_to_delete_services.yml => ssa___attempt_to_delete_services.yml} (83%)
 rename dist/ssa/detections/{attempt_to_disable_services.yml => ssa___attempt_to_disable_services.yml} (84%)
 rename dist/ssa/detections/{attempted_credential_dump_from_registry_via_reg_exe.yml => ssa___attempted_credential_dump_from_registry_via_reg_exe.yml} (84%)
 rename dist/ssa/detections/{credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml => ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml => ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_indicative_of_lazagne_command_line_options.yml => ssa___credential_extraction_indicative_of_lazagne_command_line_options.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml => ssa___credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_indicative_of_use_of_dsinternals_modules.yml => ssa___credential_extraction_indicative_of_use_of_dsinternals_modules.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_indicative_of_use_of_mimikatz_modules.yml => ssa___credential_extraction_indicative_of_use_of_mimikatz_modules.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_indicative_of_use_of_powersploit_modules.yml => ssa___credential_extraction_indicative_of_use_of_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml => ssa___credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml => ssa___credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml} (100%)
 rename dist/ssa/detections/{credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml => ssa___credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml} (100%)
 rename dist/ssa/detections/{delete_a_net_user.yml => ssa___delete_a_net_user.yml} (85%)
 rename dist/ssa/detections/{deny_permission_using_cacls_utility.yml => ssa___deny_permission_using_cacls_utility.yml} (85%)
 rename dist/ssa/detections/{detect_dump_lsass_memory_using_comsvcs.yml => ssa___detect_dump_lsass_memory_using_comsvcs.yml} (85%)
 rename dist/ssa/detections/{detect_kerberoasting.yml => ssa___detect_kerberoasting.yml} (86%)
 rename dist/ssa/detections/{detect_pass_the_hash.yml => ssa___detect_pass_the_hash.yml} (87%)
 rename dist/ssa/detections/{detect_prohibited_applications_spawning_cmd_exe.yml => ssa___detect_prohibited_applications_spawning_cmd_exe.yml} (51%)
 rename dist/ssa/detections/{disable_net_user_account.yml => ssa___disable_net_user_account.yml} (84%)
 rename dist/ssa/detections/{first_time_seen_command_line_argument.yml => ssa___first_time_seen_command_line_argument.yml} (100%)
 rename dist/ssa/detections/{grant_permission_using_cacls_utility.yml => ssa___grant_permission_using_cacls_utility.yml} (85%)
 rename dist/ssa/detections/{illegal_access_to_user_content_via_powersploit_modules.yml => ssa___illegal_access_to_user_content_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{illegal_account_creation_via_powersploit_modules.yml => ssa___illegal_account_creation_via_powersploit_modules.yml} (80%)
 rename dist/ssa/detections/{illegal_deletion_of_logs_via_mimikatz_modules.yml => ssa___illegal_deletion_of_logs_via_mimikatz_modules.yml} (100%)
 rename dist/ssa/detections/{illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml => ssa___illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml} (100%)
 rename dist/ssa/detections/{illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml => ssa___illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml} (100%)
 rename dist/ssa/detections/{illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml => ssa___illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml => ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml} (82%)
 rename dist/ssa/detections/{illegal_privilege_elevation_via_mimikatz_modules.yml => ssa___illegal_privilege_elevation_via_mimikatz_modules.yml} (82%)
 rename dist/ssa/detections/{illegal_service_and_process_control_via_mimikatz_modules.yml => ssa___illegal_service_and_process_control_via_mimikatz_modules.yml} (82%)
 rename dist/ssa/detections/{illegal_service_and_process_control_via_powersploit_modules.yml => ssa___illegal_service_and_process_control_via_powersploit_modules.yml} (84%)
 rename dist/ssa/detections/{modify_acls_permission_of_files_or_folders.yml => ssa___modify_acls_permission_of_files_or_folders.yml} (86%)
 rename dist/ssa/detections/{more_than_usual_number_of_lolbas_applications_in_short_time_period.yml => ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml} (100%)
 rename dist/ssa/detections/{phishing_email_detection_by_machine_learning_method_-_ssa.yml => ssa___phishing_email_detection_by_machine_learning_method_-_ssa.yml} (100%)
 rename dist/ssa/detections/{potential_pass_the_token_or_hash_observed_at_the_destination_device.yml => ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml} (100%)
 rename dist/ssa/detections/{potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml => ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml} (100%)
 rename dist/ssa/detections/{probing_access_with_stolen_credentials_via_powersploit_modules.yml => ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml} (79%)
 rename dist/ssa/detections/{rare_parent-child_process_relationship.yml => ssa___rare_parent-child_process_relationship.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml => ssa___reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml => ssa___reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml => ssa___reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml => ssa___reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_computers_via_mimikatz_modules.yml => ssa___reconnaissance_and_access_to_computers_via_mimikatz_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml => ssa___reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml => ssa___reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml => ssa___reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml => ssa___reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml => ssa___reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_of_connectivity_via_powersploit_modules.yml => ssa___reconnaissance_of_connectivity_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml => ssa___reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_of_defensive_tools_via_powersploit_modules.yml => ssa___reconnaissance_of_defensive_tools_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml => ssa___reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml} (100%)
 rename dist/ssa/detections/{reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml => ssa___reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml} (100%)
 rename dist/ssa/detections/{resize_shadowstorage_volume.yml => ssa___resize_shadowstorage_volume.yml} (85%)
 create mode 100644 dist/ssa/detections/ssa___sdelete_application_execution.yml
 rename dist/ssa/detections/{setting_credentials_via_dsinternals_modules.yml => ssa___setting_credentials_via_dsinternals_modules.yml} (85%)
 rename dist/ssa/detections/{setting_credentials_via_mimikatz_modules.yml => ssa___setting_credentials_via_mimikatz_modules.yml} (82%)
 rename dist/ssa/detections/{setting_credentials_via_powersploit_modules.yml => ssa___setting_credentials_via_powersploit_modules.yml} (81%)
 rename dist/ssa/detections/{system_process_running_from_unexpected_location.yml => ssa___system_process_running_from_unexpected_location.yml} (100%)
 rename dist/ssa/detections/{unusually_long_command_line.yml => ssa___unusually_long_command_line.yml} (86%)
 rename dist/ssa/detections/{wevtutil_usage_to_clear_logs.yml => ssa___wevtutil_usage_to_clear_logs.yml} (87%)
 rename dist/ssa/detections/{wevtutil_usage_to_disable_logs.yml => ssa___wevtutil_usage_to_disable_logs.yml} (86%)

diff --git a/bin/generate.py b/bin/generate.py
index 426432d43d..30abc69d09 100644
--- a/bin/generate.py
+++ b/bin/generate.py
@@ -104,8 +104,11 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
     # disable yaml pointers https://stackoverflow.com/questions/51272814/python-yaml-dumping-pointer-references
     yaml.Dumper.ignore_aliases = lambda *args : True
 
+    # wiping old detections for SSA
+    shutil.rmtree(OUTPUT_PATH + '/detections/*', ignore_errors=True)
+
     for d in detections:
-        manifest_file = OUTPUT_PATH + '/detections/' + d['name'].lower().replace(" ", "_") + '.yml'
+        manifest_file = OUTPUT_PATH + '/detections/ssa___' + d['name'].lower().replace(" ", "_") + '.yml'
 
         # remove unused fields
         del d['risk']
@@ -113,6 +116,14 @@ def generate_ssa_yaml(detections, TEMPLATE_PATH, OUTPUT_PATH):
         del d['mappings']
         del d['savedsearch_annotations']
 
+        # add detection test
+        test_file = 'ssa___' + d['name'].lower().replace(" ", "_") + '.test.yml'
+        for file in glob.glob('tests/*/*'):
+            if test_file == file.split("/")[-1]:
+                with open(file, 'r') as file:
+                    test_yaml = yaml.safe_load(file)
+                    d['test'] = test_yaml
+
         with open(manifest_file, 'w') as file:
             documents = yaml.dump(d, file, sort_keys=True)
 
@@ -414,7 +425,6 @@ def add_playbook(detection, playbooks):
             if detection['name'] in playbook['tags']['detections']:
                 detection['how_to_implement'] = detection['how_to_implement'] + preface + playbook['name']
         except KeyError:
-            print("playbook " + playbook['name'] + " has no detections, passing....")
             pass
     return detection
 
@@ -664,6 +674,43 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
     global global_product
     global_product = PRODUCT
 
+    TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
+
+    objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
+
+    try:
+        if VERBOSE:
+            print("generating Mitre lookups")
+    #    generate_mitre_lookup(OUTPUT_PATH)
+    except Exception as e:
+        print('Error: ' + str(e))
+        print("WARNING: Generation of Mitre lookup failed.")
+
+    # calculate deprecation totals
+    deprecated = []
+    for d in objects['detections']:
+        if 'deprecated' in d:
+            deprecated.append(d)
+
+    detection_path = ''
+    lookups_path = ''
+    lookups_files= ''
+    use_case_lib_path = ''
+    macros_path = ''
+    workbench_panels_objects = ''
+
+    if global_product == 'SSA':
+        detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        objects["macros"] = []
+    else:
+        detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
+        lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
+        use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
+        workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
+
     if global_product == 'API':
         json_types = []
         # List of all YAML types to search in repo
@@ -673,63 +720,25 @@ def main(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE):
         if VERBOSE: print("JSON output directory: " + output_dir)
         # remove any pre-existing output directories
         shutil.rmtree(output_dir, ignore_errors=True)
-        if VERBOSE: print("Remove pre-existing JSON directory")
+        if VERBOSE: print("remove pre-existing JSON directory")
         # create output directory
         os.mkdir(output_dir)
-        if VERBOSE: print("Created output directory")
+        if VERBOSE: print("created output directory")
         # Generate all YAML types
         for yt in yml_types:
             processor = Yaml2Json(yt, REPO_PATH)
             with open(os.path.join(output_dir, yt + '.json'), 'w') as json_out:
                 # write out YAML type
                 json.dump(processor.list_objects(yt), json_out)
-                if VERBOSE: print("Writing %s JSON" % yt)
+                if VERBOSE: print("writing {0} JSON".format(yt))
 
-    else:
-        TEMPLATE_PATH = path.join(REPO_PATH, 'bin/jinja2_templates')
-
-        objects = get_objects(REPO_PATH, OUTPUT_PATH, PRODUCT, VERBOSE)
-
-        try:
-            if VERBOSE:
-                print("generating Mitre lookups")
-        #    generate_mitre_lookup(OUTPUT_PATH)
-        except Exception as e:
-            print('Error: ' + str(e))
-            print("WARNING: Generation of Mitre lookup failed.")
-
-        # calculate deprecation totals
-        deprecated = []
-        for d in objects['detections']:
-            if 'deprecated' in d:
-                deprecated.append(d)
-
-        detection_path = ''
-        lookups_path = ''
-        lookups_files= ''
-        use_case_lib_path = ''
-        macros_path = ''
-        workbench_panels_objects = ''
-
-        if global_product == 'SSA':
-            detection_path = generate_ssa_yaml(objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            objects["macros"] = []
-        else:
-            detection_path = generate_savedsearches_conf(objects["detections"], objects["deployments"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_path = generate_transforms_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_path = generate_collections_conf(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH)
-            lookups_files = generate_lookup_files(objects["lookups"], TEMPLATE_PATH, OUTPUT_PATH,REPO_PATH)
-            use_case_lib_path = generate_use_case_library_conf(objects["stories"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            macros_path = generate_macros_conf(objects["macros"], objects["detections"], TEMPLATE_PATH, OUTPUT_PATH)
-            workbench_panels_objects = generate_workbench_panels(objects["detections"], objects["stories"], TEMPLATE_PATH, OUTPUT_PATH)
-
-        if VERBOSE:
-            print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
-            print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
-            print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
-            print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
-            print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
-            print("security content generation completed..")
+    if VERBOSE:
+        print("{0} stories have been successfully written to {1}".format(len(objects["stories"]), use_case_lib_path))
+        print("{0} detections have been successfully written to {1}".format(len(objects["detections"]), detection_path))
+        print("{0} detections have been marked deprecated on {1}".format(len(deprecated), detection_path))
+        print("{0} macros have been successfully written to {1}".format(len(objects["macros"]), macros_path))
+        print("{0} workbench panels have been successfully written to {1}, {2} and {3}".format(len(workbench_panels_objects), OUTPUT_PATH + "/default/es_investigations.conf", OUTPUT_PATH + "/default/workflow_actions.conf", OUTPUT_PATH + "/default/data/ui/panels/*"))
+        print("security content generation completed..")
 
 
 if __name__ == "__main__":
diff --git a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
similarity index 83%
rename from dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
index 59991812db..e10000d852 100644
--- a/dist/ssa/detections/applying_stolen_credentials_via_mimikatz_modules.yml
+++ b/dist/ssa/detections/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
@@ -87,5 +87,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Applying Stolen Credentials via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test applying stolen credentials detections
+    file: endpoint/ssa___applying_stolen_credentials_via_mimikatz_modules.yml
+    name: Applying Stolen Credentials via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml
similarity index 83%
rename from dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml
index e6493fea5e..ea38b09780 100644
--- a/dist/ssa/detections/applying_stolen_credentials_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___applying_stolen_credentials_via_powersploit_modules.yml
@@ -91,5 +91,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Applying Stolen Credentials via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1555/applying_stolen_credentials/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test applying stolen credentials detections
+    file: endpoint/ssa___applying_stolen_credentials_via_powersploit_modules.yml
+    name: Applying Stolen Credentials via PowerSploit
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml b/dist/ssa/detections/ssa___assessment_of_credential_strength_via_dsinternals_modules.yml
similarity index 100%
rename from dist/ssa/detections/assessment_of_credential_strength_via_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___assessment_of_credential_strength_via_dsinternals_modules.yml
diff --git a/dist/ssa/detections/attempt_to_delete_services.yml b/dist/ssa/detections/ssa___attempt_to_delete_services.yml
similarity index 83%
rename from dist/ssa/detections/attempt_to_delete_services.yml
rename to dist/ssa/detections/ssa___attempt_to_delete_services.yml
index 84a8d5688e..f79e78b080 100644
--- a/dist/ssa/detections/attempt_to_delete_services.yml
+++ b/dist/ssa/detections/ssa___attempt_to_delete_services.yml
@@ -12,7 +12,7 @@ how_to_implement: To successfully implement this search, you need to be ingestin
   Sysmon TA. Tune and filter known instances where renamed sc.exe may be used.
 id: a0c8c292-d01a-11eb-aa18-acde48001122
 known_false_positives: unknown
-name: Attempt To Delete Services
+name: Attempt To delete Services
 product:
 - Splunk Behavioral Analytics
 references:
@@ -57,5 +57,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Attempt To delete Services Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_del.log
+      file_name: sc_del.log
+      source: WinEventLog:Security
+    description: Test for usage of sc.exe to delete a service
+    file: endpoint/ssa___attempt_to_delete_services.yml
+    name: Attempt To delete Services
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/attempt_to_disable_services.yml b/dist/ssa/detections/ssa___attempt_to_disable_services.yml
similarity index 84%
rename from dist/ssa/detections/attempt_to_disable_services.yml
rename to dist/ssa/detections/ssa___attempt_to_disable_services.yml
index 4910940788..77bfc3db9d 100644
--- a/dist/ssa/detections/attempt_to_disable_services.yml
+++ b/dist/ssa/detections/ssa___attempt_to_disable_services.yml
@@ -59,5 +59,16 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Attempt To Disable Services Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/sc_disable.log
+      file_name: sc_disable.log
+      source: WinEventLog:Security
+    description: Test for usage of sc.exe to disable a service
+    file: endpoint/ssa___attempt_to_disable_services.yml
+    name: Attempt To Disable Services
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml b/dist/ssa/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
similarity index 84%
rename from dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
rename to dist/ssa/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
index 0dad28f8eb..ccc359c521 100644
--- a/dist/ssa/detections/attempted_credential_dump_from_registry_via_reg_exe.yml
+++ b/dist/ssa/detections/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
@@ -76,5 +76,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Attempted Credential Dump From Registry via Reg exe - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.002/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test credential dumping detections
+    file: endpoint/ssa___attempted_credential_dump_from_registry_via_reg_exe.yml
+    name: Attempted Credential Dump From Registry via Reg exe
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_s_option.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_fgdump_and_cachedump_with_v_option.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_lazagne_command_line_options.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_lazagne_command_line_options.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_lazagne_command_line_options.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_dsinternals_credential_conversion_modules.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_dsinternals_modules.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_use_of_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_dsinternals_modules.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_use_of_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_mimikatz_modules.yml
diff --git a/dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml b/dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_indicative_of_use_of_powersploit_modules.yml
rename to dist/ssa/detections/ssa___credential_extraction_indicative_of_use_of_powersploit_modules.yml
diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml b/dist/ssa/detections/ssa___credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
rename to dist/ssa/detections/ssa___credential_extraction_native_microsoft_debuggers_peek_into_the_kernel.yml
diff --git a/dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml b/dist/ssa/detections/ssa___credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
rename to dist/ssa/detections/ssa___credential_extraction_native_microsoft_debuggers_via_z_command_line_option.yml
diff --git a/dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml b/dist/ssa/detections/ssa___credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
similarity index 100%
rename from dist/ssa/detections/credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
rename to dist/ssa/detections/ssa___credential_extraction_via_get-addbaccount_module_present_in_powersploit_and_dsinternals.yml
diff --git a/dist/ssa/detections/delete_a_net_user.yml b/dist/ssa/detections/ssa___delete_a_net_user.yml
similarity index 85%
rename from dist/ssa/detections/delete_a_net_user.yml
rename to dist/ssa/detections/ssa___delete_a_net_user.yml
index e38926b2ee..1d8d55b806 100644
--- a/dist/ssa/detections/delete_a_net_user.yml
+++ b/dist/ssa/detections/ssa___delete_a_net_user.yml
@@ -60,5 +60,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Delete A Net User Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_del.log
+      file_name: net_user_del.log
+      source: WinEventLog:Security
+    description: Test for usage of net.exe or net1.exe to delete net user
+    file: endpoint/ssa___delete_a_net_user.yml
+    name: Delete A Net User
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 2
diff --git a/dist/ssa/detections/deny_permission_using_cacls_utility.yml b/dist/ssa/detections/ssa___deny_permission_using_cacls_utility.yml
similarity index 85%
rename from dist/ssa/detections/deny_permission_using_cacls_utility.yml
rename to dist/ssa/detections/ssa___deny_permission_using_cacls_utility.yml
index 8db36bc4e7..12dc920ad3 100644
--- a/dist/ssa/detections/deny_permission_using_cacls_utility.yml
+++ b/dist/ssa/detections/ssa___deny_permission_using_cacls_utility.yml
@@ -76,5 +76,16 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Deny Permission using Cacls Utility Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for usage of cacls deny permission to a file(s) or folder(s)
+    file: endpoint/ssa___deny_permission_using_cacls_utility.yml
+    name: Deny Permission using Cacls Utility
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml b/dist/ssa/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml
similarity index 85%
rename from dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml
rename to dist/ssa/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml
index b1c7914dfb..4e8a441553 100644
--- a/dist/ssa/detections/detect_dump_lsass_memory_using_comsvcs.yml
+++ b/dist/ssa/detections/ssa___detect_dump_lsass_memory_using_comsvcs.yml
@@ -75,5 +75,16 @@ tags:
   risk_score: 70
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Detect Dump LSASS Memory using comsvcs - SSA Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003.001/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test credential dumping detections
+    file: endpoint/ssa___detect_dump_lsass_memory_using_comsvcs.yml
+    name: Detect Dump LSASS Memory using comsvcs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/detect_kerberoasting.yml b/dist/ssa/detections/ssa___detect_kerberoasting.yml
similarity index 86%
rename from dist/ssa/detections/detect_kerberoasting.yml
rename to dist/ssa/detections/ssa___detect_kerberoasting.yml
index b13d0b9267..d0b54fede6 100644
--- a/dist/ssa/detections/detect_kerberoasting.yml
+++ b/dist/ssa/detections/ssa___detect_kerberoasting.yml
@@ -78,5 +78,16 @@ tags:
   risk_score: 14
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Detect Kerberoasting - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1558.003/atomic_red_team/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test detection of kerberoasting
+    file: endpoint/ssa___detect_kerberoasting.yml
+    name: Detect kerberoasting
+    pass_condition: '@count_eq(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/detect_pass_the_hash.yml b/dist/ssa/detections/ssa___detect_pass_the_hash.yml
similarity index 87%
rename from dist/ssa/detections/detect_pass_the_hash.yml
rename to dist/ssa/detections/ssa___detect_pass_the_hash.yml
index 9f263ff519..84b3ce29a1 100644
--- a/dist/ssa/detections/detect_pass_the_hash.yml
+++ b/dist/ssa/detections/ssa___detect_pass_the_hash.yml
@@ -1,8 +1,12 @@
 author: Xiao Lin, Splunk
 datamodel: []
 date: '2020-10-21'
-description: This search looks for specific authentication events from the Windows
-  Security Event logs to detect potential attempts using Pass-the-Hash technique.
+deprecated: true
+description: 'WARNING, this detection has been marked deprecated by the Splunk Threat
+  Research team, this means that it will no longer be maintained or supported. If
+  you have any questions feel free to email us at: research@splunk.com. This search
+  looks for specific authentication events from the Windows Security Event logs to
+  detect potential attempts using Pass-the-Hash technique.'
 how_to_implement: The test data is converted from Windows Security Event logs generated
   from Attach Range simulation and used in SPL search and extended to SPL2
 id: 7cd8b9fa-6b0c-424f-92a6-9c5287a72f5f
diff --git a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml b/dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
similarity index 51%
rename from dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml
rename to dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
index 3f956fddcf..2b8356d3ea 100644
--- a/dist/ssa/detections/detect_prohibited_applications_spawning_cmd_exe.yml
+++ b/dist/ssa/detections/ssa___detect_prohibited_applications_spawning_cmd_exe.yml
@@ -1,23 +1,26 @@
 author: Ignacio Bermudez Corrales, Splunk
 datamodel: []
-date: 2020-7-13
-description: This search looks for executions of cmd.exe spawned by a process that
-  is often abused by attackers and that does not typically launch cmd.exe. This is
-  a SPL2 implementation of the rule `Detect Prohibited Applications Spawning cmd.exe`
-  by @bpatel.
-how_to_implement: You must be ingesting sysmon logs. This search has been modified
+date: '2021-11-10'
+description: The following analytic identifies parent processes, browsers, Windows
+  terminal applications, Office Products and Java spawning cmd.exe. By its very nature,
+  many applications spawn cmd.exe natively or built into macros. Much of this will
+  need to be tuned to further enhance the risk. During triage, review parallel process
+  execution and identify any file modifications that may have occurred. Capture any
+  artifacts and review further.
+how_to_implement: In order to successfully implement this analytic, you will need
+  endpoint process data from a EDR product or Sysmon. This search has been modified
   to process raw sysmon data from attack_range's nxlogs on DSP.
 id: c10a18cb-fd80-4ffa-a844-25026e0a0c94
 known_false_positives: There are circumstances where an application may legitimately
-  execute and interact with the Windows command-line interface. Investigate and modify
-  the lookup file, as appropriate.
+  execute and interact with the Windows command-line interface.
 name: Detect Prohibited Applications Spawning cmd exe
 product:
 - Splunk Behavioral Analytics
-references: []
-risk_message: Potential malicious landing to the console via unexpected programs that
-  called cmd.exe.  Operation is performed at the device $dest_device_id$, by the account
-  $dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
+references:
+- https://attack.mitre.org/techniques/T1059/
+risk_message: An instance of $parent_process_name$ spawning $process_name$ was identified
+  on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
+  that warrants investigating.
 search: '| from read_ssa_enriched_events()
 
   | eval timestamp=parse_long(ucast(map_get(input_event, "_time"), "string", null))
@@ -39,23 +42,18 @@ search: '| from read_ssa_enriched_events()
 tags:
   analytic_story:
   - Suspicious Command-Line Executions
-  - Suspicious MSHTA Activity
-  - Suspicious Zoom Child Processes
-  - Sunburst Malware
   cis20:
   - CIS 8
-  confidence: 80
+  confidence: 50
   context:
-  - Source:AD
   - Source:Endpoint
-  - Stage:Command And Control
-  - Consequence:Loss Of Control
+  - Stage:Defense Evasion
   impact: 70
   kill_chain_phases:
   - Exploitation
-  message: Potential malicious landing to the console via unexpected programs that
-    called cmd.exe.  Operation is performed at the device $dest_device_id$, by the
-    account $dest_user_id$ where parent process $parent_process$ spwaned $process_name$.
+  message: An instance of $parent_process_name$ spawning $process_name$ was identified
+    on endpoint $dest_device_id$ by user $dest_user_id$, producing a suspicious event
+    that warrants investigating.
   mitre_attack_id:
   - T1059
   nist:
@@ -70,10 +68,14 @@ tags:
     role:
     - Victim
     type: Hostname
-  - name: cmd_line
+  - name: parent_process_name
     role:
-    - Others
-    type: processname
+    - Parent Process
+    type: Parent Process
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
   product:
   - Splunk Behavioral Analytics
   required_fields:
@@ -82,8 +84,19 @@ tags:
   - _time
   - dest_device_id
   - dest_user_id
-  risk_score: 56
-  risk_severity: low
+  risk_score: 35
+  risk_severity: medium
   security_domain: endpoint
-type: TTP
-version: 1
+test:
+  name: Detect Prohibited Applications Spawning cmd exe Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/powershell_spawn_cmd/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Detect Prohibited Applications Spawning cmd exe
+    file: endpoint/ssa___prohibited_apps_spawning_cmdprompt.yml
+    name: Detect Prohibited Applications Spawning cmd exe
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 2
diff --git a/dist/ssa/detections/disable_net_user_account.yml b/dist/ssa/detections/ssa___disable_net_user_account.yml
similarity index 84%
rename from dist/ssa/detections/disable_net_user_account.yml
rename to dist/ssa/detections/ssa___disable_net_user_account.yml
index 6bdecec8ff..2193dc4453 100644
--- a/dist/ssa/detections/disable_net_user_account.yml
+++ b/dist/ssa/detections/ssa___disable_net_user_account.yml
@@ -59,5 +59,16 @@ tags:
   - process
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Disable Net User Account Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/net_user_dis.log
+      file_name: net_user_dis.log
+      source: WinEventLog:Security
+    description: Test for usage of net.exe or net1.exe to disable net user
+    file: endpoint/ssa___disable_net_user_account.yml
+    name: Disable Net User Account
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/first_time_seen_command_line_argument.yml b/dist/ssa/detections/ssa___first_time_seen_command_line_argument.yml
similarity index 100%
rename from dist/ssa/detections/first_time_seen_command_line_argument.yml
rename to dist/ssa/detections/ssa___first_time_seen_command_line_argument.yml
diff --git a/dist/ssa/detections/grant_permission_using_cacls_utility.yml b/dist/ssa/detections/ssa___grant_permission_using_cacls_utility.yml
similarity index 85%
rename from dist/ssa/detections/grant_permission_using_cacls_utility.yml
rename to dist/ssa/detections/ssa___grant_permission_using_cacls_utility.yml
index 72d50af052..58c6d51d1c 100644
--- a/dist/ssa/detections/grant_permission_using_cacls_utility.yml
+++ b/dist/ssa/detections/ssa___grant_permission_using_cacls_utility.yml
@@ -76,5 +76,16 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Grant Permission Using Cacls Utility Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for usage of cacls grant permission to a file(s) or folder(s)
+    file: endpoint/ssa___grant_permission_using_cacls_utility.yml
+    name: Grant Permission Using Cacls Utility
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_access_to_user_content_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_access_to_user_content_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_access_to_user_content_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_account_creation_via_powersploit_modules.yml
similarity index 80%
rename from dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_account_creation_via_powersploit_modules.yml
index 15a2017e7f..215a06f846 100644
--- a/dist/ssa/detections/illegal_account_creation_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_account_creation_via_powersploit_modules.yml
@@ -74,5 +74,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Account Creation via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1021/illegal_access_to_content/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal account creation detections
+    file: endpoint/ssa___illegal_account_creation_via_powersploit_modules.yml
+    name: Illegal Account Creation via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___illegal_deletion_of_logs_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_deletion_of_logs_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___illegal_deletion_of_logs_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml b/dist/ssa/detections/ssa___illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___illegal_enabling_or_disabling_of_accounts_via_dsinternals_modules.yml
diff --git a/dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml b/dist/ssa/detections/ssa___illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___illegal_management_of_active_directory_elements_and_policies_via_dsinternals_modules.yml
diff --git a/dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_management_of_computers_and_active_directory_elements_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
similarity index 82%
rename from dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
index 1fa9004a72..ded427a427 100644
--- a/dist/ssa/detections/illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
@@ -83,5 +83,17 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Privilege Elevation and Persistence via PowerSploit modules - SSA
+    Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test privilege elevation and persistence detections
+    file: endpoint/ssa___illegal_privilege_elevation_and_persistence_via_powersploit_modules.yml
+    name: Illegal Privilege Elevation and Persistence via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
similarity index 82%
rename from dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
index 4983ffeeb3..b6c1975098 100644
--- a/dist/ssa/detections/illegal_privilege_elevation_via_mimikatz_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
@@ -78,5 +78,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Privilege Elevation via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1548/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal privilege elevation detections
+    file: endpoint/ssa___illegal_privilege_elevation_via_mimikatz_modules.yml
+    name: Illegal Privilege Elevation via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
similarity index 82%
rename from dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
index 7a9d428326..d8a00d1165 100644
--- a/dist/ssa/detections/illegal_service_and_process_control_via_mimikatz_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
@@ -80,5 +80,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Service and Process Control via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal service and process control detections
+    file: endpoint/ssa___illegal_service_and_process_control_via_mimikatz_modules.yml
+    name: Illegal Service and Process Control via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml b/dist/ssa/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
similarity index 84%
rename from dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
index e45c13be43..79a5671eda 100644
--- a/dist/ssa/detections/illegal_service_and_process_control_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
@@ -90,5 +90,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Illegal Service and Process Control via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal service and process control detections
+    file: endpoint/ssa___illegal_service_and_process_control_via_powersploit_modules.yml
+    name: Illegal Service and Process Control via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml b/dist/ssa/detections/ssa___modify_acls_permission_of_files_or_folders.yml
similarity index 86%
rename from dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml
rename to dist/ssa/detections/ssa___modify_acls_permission_of_files_or_folders.yml
index d719775266..0fafcd54c2 100644
--- a/dist/ssa/detections/modify_acls_permission_of_files_or_folders.yml
+++ b/dist/ssa/detections/ssa___modify_acls_permission_of_files_or_folders.yml
@@ -79,5 +79,17 @@ tags:
   risk_score: 35
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Modify ACLs Permission Of Files Or Folders Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1222.001/ssa_cacls/all_icalc.log
+      file_name: all_icalc.log
+      source: WinEventLog:Security
+    description: Test for modifying permission of a file(s) or folder(s) using cacls
+      utility.
+    file: endpoint/ssa___modify_acls_permission_of_files_or_folders.yml
+    name: Modify ACLs Permission Of Files Or Folders
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1
diff --git a/dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml b/dist/ssa/detections/ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
similarity index 100%
rename from dist/ssa/detections/more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
rename to dist/ssa/detections/ssa___more_than_usual_number_of_lolbas_applications_in_short_time_period.yml
diff --git a/dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml b/dist/ssa/detections/ssa___phishing_email_detection_by_machine_learning_method_-_ssa.yml
similarity index 100%
rename from dist/ssa/detections/phishing_email_detection_by_machine_learning_method_-_ssa.yml
rename to dist/ssa/detections/ssa___phishing_email_detection_by_machine_learning_method_-_ssa.yml
diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml b/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
similarity index 100%
rename from dist/ssa/detections/potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
rename to dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_at_the_destination_device.yml
diff --git a/dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml b/dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
similarity index 100%
rename from dist/ssa/detections/potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
rename to dist/ssa/detections/ssa___potential_pass_the_token_or_hash_observed_by_an_event_collecting_device.yml
diff --git a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml b/dist/ssa/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
similarity index 79%
rename from dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
index 0ca07c65e5..fa42a74f4c 100644
--- a/dist/ssa/detections/probing_access_with_stolen_credentials_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
@@ -75,5 +75,17 @@ tags:
   risk_score: 60
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Probing Access with Stolen Credentials via PowerSploit modules - SSA Unit
+    test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test access probing with stolen credentials detections
+    file: endpoint/ssa___probing_access_with_stolen_credentials_via_powersploit_modules.yml
+    name: Probing Access with Stolen Credentials via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/rare_parent-child_process_relationship.yml b/dist/ssa/detections/ssa___rare_parent-child_process_relationship.yml
similarity index 100%
rename from dist/ssa/detections/rare_parent-child_process_relationship.yml
rename to dist/ssa/detections/ssa___rare_parent-child_process_relationship.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_accounts_and_groups_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_accounts_groups_and_policies_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_active_directoty_infrastructure_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_computers_and_domains_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_computers_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_operating_system_elements_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_processes_and_services_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_shared_resources_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_and_access_to_shared_resources_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_access_and_persistence_opportunities_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_connectivity_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_connectivity_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_connectivity_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_credential_stores_and_services_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_defensive_tools_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_defensive_tools_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_defensive_tools_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_privilege_escalation_opportunities_via_powersploit_modules.yml
diff --git a/dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
similarity index 100%
rename from dist/ssa/detections/reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___reconnaissance_of_process_or_service_hijacking_opportunities_via_mimikatz_modules.yml
diff --git a/dist/ssa/detections/resize_shadowstorage_volume.yml b/dist/ssa/detections/ssa___resize_shadowstorage_volume.yml
similarity index 85%
rename from dist/ssa/detections/resize_shadowstorage_volume.yml
rename to dist/ssa/detections/ssa___resize_shadowstorage_volume.yml
index b173fa9bd4..58f1a8645f 100644
--- a/dist/ssa/detections/resize_shadowstorage_volume.yml
+++ b/dist/ssa/detections/ssa___resize_shadowstorage_volume.yml
@@ -61,5 +61,16 @@ tags:
   - process
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Resize Shadowstorage Volume Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/malware/ransomware_ttp/ssa_data1/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test for resizing the shadow storage of a machine
+    file: endpoint/ssa___resize_shadowstorage_volume.yml
+    name: Resize Shadowstorage Volume
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/ssa___sdelete_application_execution.yml b/dist/ssa/detections/ssa___sdelete_application_execution.yml
new file mode 100644
index 0000000000..44341ebf5a
--- /dev/null
+++ b/dist/ssa/detections/ssa___sdelete_application_execution.yml
@@ -0,0 +1,105 @@
+author: Teoderick Contreras, Splunk
+datamodel:
+- Endpoint
+date: '2021-11-15'
+description: This analytic will detect the execution of sdelete.exe attempting to
+  delete potentially important files that may related to adversary or insider threats
+  to destroy evidence or information sabotage. Sdelete is a SysInternals utility meant
+  to securely delete files on disk. This tool is commonly used to clear tracks and
+  artifact on the targeted host.
+how_to_implement: To successfully implement this search you need to be ingesting information
+  on process that include the name of the process responsible for the changes from
+  your endpoints into the `Endpoint` datamodel in the `Processes` node. In addition,
+  confirm the latest CIM App 4.20 or higher is installed and the latest TA for the
+  endpoint product.
+id: fcc52b9a-4616-11ec-8454-acde48001122
+known_false_positives: False positives should be limited, filter as needed.
+name: Sdelete Application Execution
+product:
+- Splunk Behavioral Analytics
+references:
+- https://thedfirreport.com/2020/04/20/sqlserver-or-the-miner-in-the-basement/
+- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1485/T1485.md
+risk_message: sdelete process $process_name$ executed on $dest$ attempting to permanently
+  delete files.
+search: '| from read_ssa_enriched_events() | eval timestamp=parse_long(ucast(map_get(input_event,"_time"),
+  "string", null)), cmd_line=lower(ucast(map_get(input_event, "process"), "string",
+  null)), process_name=lower(ucast(map_get(input_event, "process_name"), "string",
+  null)), process_path=ucast(map_get(input_event, "process_path"), "string", null),
+  parent_process_name=ucast(map_get(input_event, "parent_process_name"), "string",
+  null), parent_cmd_line=ucast(map_get(input_event, "parent_process"), "string", null),
+  event_id=ucast(map_get(input_event, "event_id"), "string", null) | where cmd_line
+  IS NOT NULL AND process_name IS NOT NULL AND like(process_name, "%sdelete%") AND
+  (like (cmd_line, "%-c %") OR like (cmd_line, "%-f %")OR like (cmd_line, "%-p %")
+  OR like (cmd_line, "%-r %") OR like (cmd_line, "%-q %") OR like (cmd_line, "%-s
+  %") OR like (cmd_line, "%-z %") OR like (cmd_line, "%/accepteula%") OR like (cmd_line,
+  "%-nobanner%")OR like (cmd_line, "%.doc%")OR like (cmd_line, "%.xls%") OR like (cmd_line,
+  "%.ppt%")OR like (cmd_line, "%.rtf%") OR like (cmd_line, "%.pdf%") OR like (cmd_line,
+  "%.key%")OR like (cmd_line, "%.log%") OR like (cmd_line, "%.txt%") OR like (cmd_line,
+  "%.jpg%") OR like (cmd_line, "%.png%") OR like (cmd_line, "%.gif%") OR like (cmd_line,
+  "%.bmp%") OR like (cmd_line, "%.7z%")  OR like (cmd_line, "%.zip%") OR like (cmd_line,
+  "%.rar%") OR like (cmd_line, "%.tar%") OR like (cmd_line, "%.gz%") OR like (cmd_line,
+  "%.xls%")) | eval start_time=timestamp, end_time=timestamp, entities=mvappend(ucast(map_get(input_event,
+  "dest_user_id"), "string", null), ucast(map_get(input_event, "dest_device_id"),
+  "string", null)), body=create_map(["event_id", event_id, "cmd_line", cmd_line, "process_name",
+  process_name, "process_path", process_path, "parent_process_name", parent_process_name,
+  "parent_cmd_line", parent_cmd_line]) | into write_ssa_detected_events();'
+tags:
+  analytic_story:
+  - Information Sabotage
+  confidence: 70
+  context:
+  - Source:Endpoint
+  - Stage:Execution
+  dataset:
+  - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
+  impact: 60
+  kill_chain_phases:
+  - Exploitation
+  message: sdelete process $process_name$ executed on $dest$ attempting to permanently
+    delete files.
+  mitre_attack_id:
+  - T1485
+  - T1070.004
+  - T1070
+  observable:
+  - name: dest
+    role:
+    - Victim
+    type: Endpoint
+  - name: user
+    role:
+    - Victim
+    type: User
+  - name: process_name
+    role:
+    - Child Process
+    type: Process
+  product:
+  - Splunk Behavioral Analytics
+  required_fields:
+  - _time
+  - dest
+  - user
+  - parent_process_name
+  - parent_process
+  - process_name
+  - process
+  - process_id
+  - process_path
+  risk_score: 42
+  risk_severity: medium
+  security_domain: endpoint
+test:
+  name: Sdelete Application Execution Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1485/sdelete/security.log
+      file_name: security.log
+      source: WinEventLog:Security
+    description: Test for sdelete execution command
+    file: endpoint/ssa___sdelete_application_execution.yml
+    name: Sdelete Application Execution
+    pass_condition: '@count_gt(0)'
+type: Anomaly
+version: 1
diff --git a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml b/dist/ssa/detections/ssa___setting_credentials_via_dsinternals_modules.yml
similarity index 85%
rename from dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
rename to dist/ssa/detections/ssa___setting_credentials_via_dsinternals_modules.yml
index 166baf69cc..140a65157e 100644
--- a/dist/ssa/detections/setting_credentials_via_dsinternals_modules.yml
+++ b/dist/ssa/detections/ssa___setting_credentials_via_dsinternals_modules.yml
@@ -87,5 +87,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via DSInternals modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllDSInternalsModules.log
+      file_name: logAllDSInternalsModules.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_dsinternals_modules.yml
+    name: Setting Credentials via DSInternals modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml b/dist/ssa/detections/ssa___setting_credentials_via_mimikatz_modules.yml
similarity index 82%
rename from dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
rename to dist/ssa/detections/ssa___setting_credentials_via_mimikatz_modules.yml
index 1e39fa2bb3..e55b96f9c9 100644
--- a/dist/ssa/detections/setting_credentials_via_mimikatz_modules.yml
+++ b/dist/ssa/detections/ssa___setting_credentials_via_mimikatz_modules.yml
@@ -77,5 +77,16 @@ tags:
   risk_score: 80
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via Mimikatz modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllMimikatzModules.log
+      file_name: logAllMimikatzModules.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_mimikatz_modules.yml
+    name: Setting Credentials via Mimikatz modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml b/dist/ssa/detections/ssa___setting_credentials_via_powersploit_modules.yml
similarity index 81%
rename from dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
rename to dist/ssa/detections/ssa___setting_credentials_via_powersploit_modules.yml
index e7c7216cee..1bade53958 100644
--- a/dist/ssa/detections/setting_credentials_via_powersploit_modules.yml
+++ b/dist/ssa/detections/ssa___setting_credentials_via_powersploit_modules.yml
@@ -77,5 +77,16 @@ tags:
   risk_score: 90
   risk_severity: high
   security_domain: endpoint
+test:
+  name: Setting Credentials via PowerSploit modules - SSA Unit test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1003/credential_extraction/logAllPowerSploitModulesWithOldNames.log
+      file_name: logAllPowerSploitModulesWithOldNames.log
+      source: WinEventLog:Security
+    description: Test illegal credential setting detections
+    file: endpoint/ssa___setting_credentials_via_powersploit_modules.yml
+    name: Setting Credentials via PowerSploit modules
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 1
diff --git a/dist/ssa/detections/system_process_running_from_unexpected_location.yml b/dist/ssa/detections/ssa___system_process_running_from_unexpected_location.yml
similarity index 100%
rename from dist/ssa/detections/system_process_running_from_unexpected_location.yml
rename to dist/ssa/detections/ssa___system_process_running_from_unexpected_location.yml
diff --git a/dist/ssa/detections/unusually_long_command_line.yml b/dist/ssa/detections/ssa___unusually_long_command_line.yml
similarity index 86%
rename from dist/ssa/detections/unusually_long_command_line.yml
rename to dist/ssa/detections/ssa___unusually_long_command_line.yml
index c5b719e75c..f3d16e7588 100644
--- a/dist/ssa/detections/unusually_long_command_line.yml
+++ b/dist/ssa/detections/ssa___unusually_long_command_line.yml
@@ -71,5 +71,16 @@ tags:
   risk_score: 12
   risk_severity: medium
   security_domain: endpoint
+test:
+  name: Unusually Long Command Line - SSA Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1059.003/unusally_cmd_line/windows-security.log
+      file_name: windows-security.log
+      source: WinEventLog:Security
+    description: Test unusually long command lines
+    file: endpoint/ssa___unusually_long_command_line.yml
+    name: Unusually Long Command Line
+    pass_condition: '@count_gt(0)'
 type: Anomaly
 version: 1
diff --git a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml b/dist/ssa/detections/ssa___wevtutil_usage_to_clear_logs.yml
similarity index 87%
rename from dist/ssa/detections/wevtutil_usage_to_clear_logs.yml
rename to dist/ssa/detections/ssa___wevtutil_usage_to_clear_logs.yml
index 32b1e15fbb..7d110e776f 100644
--- a/dist/ssa/detections/wevtutil_usage_to_clear_logs.yml
+++ b/dist/ssa/detections/ssa___wevtutil_usage_to_clear_logs.yml
@@ -81,5 +81,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: WevtUtil Usage To Clear Logs Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/clear_evt.log
+      file_name: clear_evt.log
+      source: WinEventLog:Security
+    description: Test for wevtutil clear logs command
+    file: endpoint/ssa___wevtutil_usage_to_clear_logs.yml
+    name: WevtUtil Usage To Clear Logs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2
diff --git a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml b/dist/ssa/detections/ssa___wevtutil_usage_to_disable_logs.yml
similarity index 86%
rename from dist/ssa/detections/wevtutil_usage_to_disable_logs.yml
rename to dist/ssa/detections/ssa___wevtutil_usage_to_disable_logs.yml
index 9c20f4a7af..5abf1e858a 100644
--- a/dist/ssa/detections/wevtutil_usage_to_disable_logs.yml
+++ b/dist/ssa/detections/ssa___wevtutil_usage_to_disable_logs.yml
@@ -77,5 +77,16 @@ tags:
   risk_score: 63
   risk_severity: low
   security_domain: endpoint
+test:
+  name: Wevtutil Usage To Disable Logs Unit Test
+  tests:
+  - attack_data:
+    - data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1070.001/ssa_wevtutil/disable_evt.log
+      file_name: disable_evt.log
+      source: WinEventLog:Security
+    description: Test for wevtutil disable logs command
+    file: endpoint/ssa___wevtutil_usage_to_disable_logs.yml
+    name: Wevtutil Usage To Disable Logs
+    pass_condition: '@count_gt(0)'
 type: TTP
 version: 2